heavy forwarder configuration path

[sansri7680]

Which is the path where the configuration for heavy forwarder needs to be stored. whether it is the usual path $SPLUNK_HOME/etc/system/local or is it a different path

[kristian_kolb · Accepted solution]

If you put stuff (config-files) in $SPLINK_HOME/etc/system/local, that should most likely work fine.

However, you need to figure out which settings go where in a distributed setup - depending on which phase occurs where. There are some settings related to the Input Phase, others that only have meaning in the Parsing Phase, etc etc.

This page may prove beneficial:

http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

/Kristian

[sansri7680]

can you give me an example configuration for receiving a light forwarder data by a heavy forwarder and forwarding it to an indexer